Manager, IT Auditor

Bain & Company • Boston, MA

21d • $99,500 - $137,500 • Hybrid

About The Position

As a Manager, IT Auditor, you will hold a senior individual contributor role within the Internal Audit function, operating as part of the organization’s third line of defense. In this role, you will work closely with Global Internal Audit leadership, which reports directly into the Chief Risk Officer and the Board Risk Subcommittee. Your work will focus on providing independent assurance over the design and operating effectiveness of the organization’s technology processes and controls through risk-based audit engagements, delivering insights that help management strengthen technology processes, controls, and risk management practices. Perform and lead assigned IT audit engagements across technology risk areas such as cybersecurity, cloud environments, AI and generative AI, third-party risk, data governance, and IT operations. You will lead end-to-end audit engagements on a continuous or risk-based cycle throughout the year, bringing strong IT audit knowledge and a risk-based perspective to each engagement. The role carries no direct reports to start; you will coach team members on engagements, with the opportunity to take on formal supervisory responsibility as the function grows.

Requirements

• Deep understanding of IT risk, control frameworks, and audit methodology (IIA Standards, COSO, COBIT, NIST Cybersecurity Framework).
• Strong knowledge of IT general controls and IT audit methodology, with working knowledge of cybersecurity, cloud risk, vendor management, and related technology risk areas sufficient to assess controls against established frameworks.
• Practical experience auditing data governance and oversight frameworks, including data ownership, classification and retention, data quality, and data traceability.
• Working knowledge of application development lifecycle and change management controls across waterfall, agile, and DevOps delivery models.
• Familiarity with AI risk and governance frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act) as applied to enterprise AI deployments.
• Experience supporting external certification and attestation engagements (e.g., CMMC, ISO 27001, SOC 1/SOC 2), including interfacing directly with certification bodies, assessors, or third-parties.
• Proficiency with analytics tools (SQL, Power BI, ACL/Galvanize) and AI assistants such as Claude or ChatGPT to support continuous auditing and automation.
• Able to convey complex technical risk, in writing and verbally, to non-technical audiences and manage stakeholders at all levels.
• Able to coach colleagues and peer review workpapers, holding engagements to a consistent methodology and quality standard.
• High degree of professional scepticism, integrity, and objectivity.
• Bachelor’s degree in Information Technology, Computer Science, Accounting Information Systems, or a related field; advanced degree preferred.
• 6–9 years of progressive experience in IT audit, cybersecurity, or IT risk management, including 2–3 years leading audit engagements end to end.
• Prior experience in a Big 4, consulting firm, or regulated industry is a strong asset.
• CISA – Certified Information Systems Auditor
• ISO 27001 Lead Auditor

Nice To Haves

• CRISC – Certified in Risk & Information Systems Control
• Cloud or cyber risk credentials (e.g., CCSP, Security+)
• AI governance credentials (e.g., IAPP AIGP, ISO/IEC 42001 Lead Auditor)

Responsibilities

• Lead assigned IT audit engagements within the approved annual audit plan, developing risk-based audit procedures and testing approaches consistent with established audit methodology and risk priorities.
• Assess the governance and controls around AI and generative AI tools (e.g., Claude, ChatGPT, Copilot), acceptable use, data privacy, model and vendor due diligence, human-in-the-loop review, and output validation.
• Design audit programs, end-to-end process walkthroughs, test procedures, and sampling strategies tailored to the risk profile of each engagement.
• Test core IT general controls, covering logical access and periodic user access reviews, change and configuration management, IT operations and job scheduling, and backup and recovery.
• Test cybersecurity controls, covering vulnerability and patch management, security monitoring and threat detection, identity and access security, and incident response readiness.
• Audit data governance and oversight, including data ownership and stewardship, classification and retention, data quality controls, traceability and access rights, and the effectiveness of governance forums in exercising oversight over data use.
• Identify process gaps and control design weaknesses and recommend sustainable, repeatable control improvements to process owners.
• Review the software development lifecycle, including design approval, secure coding, testing and UAT, release management, segregation of duties, and post-implementation review.
• Present audit findings, recommendations, and status updates to senior internal management.
• Provide guidance to stakeholders on IT audit findings, control effectiveness, and identified technology risks.
• Collaborate with the first and second lines of defense to understand and support alignment on established control objectives and risk tolerances.
• Recommend improvements to key controls in collaboration with process and control owners, identify opportunities to reduce duplicative or low-value controls and recommend appropriate improvements, and identify opportunities to improve continuous control monitoring and automated testing.
• Coordinate with external certification bodies, assessors, and third-parties in support of external certification and attestation programs (e.g., CMMC, ISO 27001, SOC 1/SOC 2), including readiness assessments, evidence requests, and findings follow-up.
• Produce high-quality internal audit reports with clear, risk-rated findings and actionable recommendations.
• Perform root-cause analysis on control failures, distinguishing design gaps from execution breakdowns so remediation addresses the underlying process rather than the symptom.
• Monitor remediation progress, assess management action plans, validate completion of agreed actions, and report status to relevant stakeholders.
• Maintain audit documentation in accordance with IIA Standards and internal quality assurance requirements.
• Coach and support team members during assigned audit engagements and provide feedback to promote consistent application of audit methodology.
• Peer review workpapers and support consistent application of established audit methodology across assigned engagements.
• Contribute to enhancements to IT audit tools, analytics, and audit practices, including appropriate use of AI-enabled automation to support audit planning, testing, and reporting.

Benefits

• Annual discretionary performance bonus
• 4.5% 401(k) company contribution, which increases after 3 years of service and is 100% vested upon start date
• Bain pays 100% individual employee premiums for medical, dental and vision programs
• Generous paid time off, including parental leave, sick leave and paid holidays
• Fully vested 401(k) company contribution
• Paid Life and Long-Term Disability insurance

What This Job Offers

• Job Type: Full-time
• Career Level: Senior